Fix wrong takeover warning direction in hosted/vendor mode

The bug: overlapping_ledger_purls correctly returns the intersection of
ledger claims, but hosted and vendored flows always assumed the current
mode displaced the other without verifying that this run actually
confirmed/rewrote those packages.

Concrete failure: hosted→vendored takeover leaves both ledgers and
lockfile→vendored; a subsequent 'scan --mode hosted --dry-run' (or
hosted run with zero redirects) still reported 'redirect_supersedes_vendored'
and told the user to remove the vendored ledger—the live one.

Fix: Only emit takeover warnings when THIS RUN confirmed those packages:
- Hosted: check if confirmed redirects (packages whose URLs landed in
  lockfile) overlap with vendor ledger
- Vendored: check if actually vendored packages (Applied/Rebuilt events)
  overlap with redirect ledger

This prevents false-positive warnings on dry-runs and no-op scans where
the lockfile still points at the other mode.

Author: cursoragent

crates/socket-patch-cli/src/commands/scan/hosted.rs

@@ -472,13 +472,28 @@ pub(super) async fn run_redirect(
     // stale. Detect + warn (JSON `warnings[]` and stderr) WITHOUT deleting the
     // other mode's ledger; full reconciliation is deferred (see PR Scope).
     // Read after the ledger write above so a non-dry-run reflects this run.
+    // Only warn about PURLs that THIS RUN confirmed redirected (landed in the
+    // lockfile) — a dry-run or no-op scan that redirected zero packages must
+    // not warn, even when both ledgers exist (the lockfile still points at the
+    // vendored artifacts, not the hosted server).
     let mut takeover_warnings: Vec<serde_json::Value> = Vec::new();
-    let superseded = super::overlapping_ledger_purls(&args.common.cwd).await;
-    if !superseded.is_empty() {
-        takeover_warnings.push(serde_json::json!({
-            "code": super::REDIRECT_SUPERSEDES_VENDORED,
-            "detail": super::mode_takeover_detail(&superseded, /*current_is_hosted=*/ true),
-        }));
+    if !confirmed.is_empty() {
+        use socket_patch_core::utils::purl::{normalize_purl, strip_purl_qualifiers};
+        let confirmed_purls: std::collections::HashSet<String> = confirmed
+            .iter()
+            .map(|(purl, _)| normalize_purl(strip_purl_qualifiers(purl)).into_owned())
+            .collect();
+        let all_overlapping = super::overlapping_ledger_purls(&args.common.cwd).await;
+        let superseded: Vec<String> = all_overlapping
+            .into_iter()
+            .filter(|purl| confirmed_purls.contains(purl))
+            .collect();
+        if !superseded.is_empty() {
+            takeover_warnings.push(serde_json::json!({
+                "code": super::REDIRECT_SUPERSEDES_VENDORED,
+                "detail": super::mode_takeover_detail(&superseded, /*current_is_hosted=*/ true),
+            }));
+        }
     }
 
     // Emit an OpenVEX attestation when `--vex` was requested. The redirected

crates/socket-patch-cli/src/commands/scan/vendor_flow.rs

@@ -61,8 +61,32 @@ async fn preview_vendor_json(cwd: &Path, selected: &[PatchSearchResult]) -> serd
 /// at the envelope level (JSON `warnings[]` and stderr), mirroring
 /// [`note_classic_migration_risk`]; the stale ledger is NOT deleted here
 /// (reconciliation is deferred — see the redirect twin in `hosted.rs`).
+/// Only warns about PURLs that THIS RUN actually vendored (have Applied or
+/// Rebuilt events) — a no-op vendor run or dry-run that vendored zero packages
+/// must not warn, even when both ledgers exist.
 async fn note_vendor_supersedes_redirect(env: &mut Envelope, cwd: &Path, common: &GlobalArgs) {
-    let superseded = super::overlapping_ledger_purls(cwd).await;
+    use crate::json_envelope::PatchAction;
+    use socket_patch_core::utils::purl::{normalize_purl, strip_purl_qualifiers};
+
+    // Extract PURLs that were actually vendored in this run (Applied or Rebuilt).
+    let vendored_purls: std::collections::HashSet<String> = env
+        .events
+        .iter()
+        .filter(|e| matches!(e.action, PatchAction::Applied | PatchAction::Rebuilt))
+        .filter_map(|e| e.purl.as_ref())
+        .map(|purl| normalize_purl(strip_purl_qualifiers(purl)).into_owned())
+        .collect();
+
+    if vendored_purls.is_empty() {
+        return;
+    }
+
+    let all_overlapping = super::overlapping_ledger_purls(cwd).await;
+    let superseded: Vec<String> = all_overlapping
+        .into_iter()
+        .filter(|purl| vendored_purls.contains(purl))
+        .collect();
+
     if superseded.is_empty() {
         return;
     }